Critical SEPPMail Secure E-Mail Gateway Flaws Enable RCE and Full Mail Traffic Interception

Multiple critical vulnerabilities disclosed in SEPPMail’s Secure E-Mail Gateway appliance could allow an attacker to achieve remote code execution or read all mail passing through the gateway. Researchers noted the flaws could serve as an entry vector into an organization’s internal network, given the gateway’s privileged network position.

SEPPMail is used by enterprises for email encryption and compliance. The irony of an email security appliance enabling wholesale mail interception makes this especially damaging in regulated sectors. Organizations should apply vendor patches immediately and audit gateway access logs for any signs of unauthorized access to the virtual appliance.